Torjan Embeded in plugin “Ultimate Member”

@adityashah This appears to be a false-positive, as VirusTotal now only reports the trojan on 1 of 58 scans, and the Malwr report simply fails to even scan the file.

I have scanned the files myself and found nothing.

For future reference, this is the proper way to report security issues with plugins: https://developer.www.ads-software.com/plugins/wordpress-org/plugin-security/reporting-plugin-security-issues/

hey @macmanx
if you check below on malwr site,
it is clearly showing https://malwr.com/analysis/NmQzOGEwODFjMjUzNDg5NDlhNThkNWJmNTQyNWQwNGQ/
that it has matched shellcode patterns,
shellcode – Matched shellcode byte patterns,
so if two sites are confirming that it is a malware then i think it is a malware, and
ps. “not all malwares are detected by antivirus”

There is no trojan or malware in this plugin. What you have found is absolutely, 100%, a false positive.

Both of your links show that only one anti-virus scanner, namely “Jiangmin”, found anything. What it says it found was a bad bit of script code. Likely javascript.

However, manually scanning the files, by hand, which I have done, shows that there’s nothing malicious there. There isn’t even anything encrypted or hidden as far as I can see.

False positives happen all the time. Also, I would not necessarily put a lot of faith in one obscure Chinese anti-virus product happening to detect malware that 55 other products fail to detect.

This plugin is clean.

Hi @adityashah,

Thanks for bringing this to our attention. First off, to avoid panic from other users just want to state that the plugin does not include any malware or code used to infect a computer.

We’ve investigated this and found what is causing you to get this warning message.

It appears that the virus scanner brought up an alert simply because of a word we use in one of our files which is “system”. We have this word in our plugin as we have the functionality for a user to download a system report (shows install information such as WP version, plugins installed etc) which helps with support requests.

We have replaced the word “system” with the word “install” and run it through the virus scanner and no longer get the virus alert.

You can see the code commit we have done for this on github: https://github.com/ultimatemember/ultimatemember/commit/ac8a3357b22102b4ce3383cc491e5f4d3b073684

You are welcome to run this updated github version through the scanner and you should no longer see this alert:

https://github.com/ultimatemember/ultimatemember/releases/tag/pre-v1.3.85.3

Once you’ve run this updated version through the virus scanner, I would greatly appreciate it if you could change your review: https://www.ads-software.com/support/topic/dont-install-included-a-tojan-into-the-zip-file/ as don’t want users to be panicked by this review and end up not using the plugin when there is no malware risk.

Thank you!